Ax Developer CMS Index.PHP Local File Include Vulnerability

Bugtraq ID:	26306
Class:	Input Validation Error
CVE:	CVE-2007-5820
Remote:	Yes
Local:	No
Published:	Nov 02 2007 12:00AM
Updated:	Nov 15 2007 12:39AM
Credit:	GoLd_M with the discovery of this vulnerability.
Vulnerable:	Ax Developer CMS Ax Developer CMS 0.1.1
Not Vulnerable:

Ax Developer CMS Index.PHP Local File Include Vulnerability

Ax Developer CMS (AxDCMS) is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized user to execute local scripts or to view arbitrary files that may contain sensitive information that can aid in further attacks.

AxDCMS 0.1.1 is vulnerable; other versions may also be affected.

Ax Developer CMS Index.PHP Local File Include Vulnerability

Attackers can exploit this issue via a browser.

The following proof-of-concept URI is available:

http://www.example.com/index.php?module=../../../../../../../../etc/passwd%00

Ax Developer CMS Index.PHP Local File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

Ax Developer CMS Index.PHP Local File Include Vulnerability

References:

• Ax Developer CMS Homepage (Ax Developer CMS)